feat(auth): implement decoupled sliding-window rate limiting for login and oauth

backend/plugins/infra/cache/limiter.go

@@ -0,0 +1,59 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package cache
+
+import (
+	"Wavelet/core/contracts"
+	"context"
+
+	"github.com/go-redis/redis_rate/v10"
+	"github.com/redis/go-redis/v9"
+)
+
+type redisLimiterImpl struct {
+	limiter   *redis_rate.Limiter
+	keyPrefix string
+}
+
+func newRedisLimiter(client redis.UniversalClient, keyPrefix string) contracts.LimiterService {
+	return &redisLimiterImpl{
+		limiter:   redis_rate.NewLimiter(client),
+		keyPrefix: keyPrefix,
+	}
+}
+
+func (r *redisLimiterImpl) prefixedKey(key string) string {
+	if r.keyPrefix != "" {
+		return r.keyPrefix + "limiter:" + key
+	}
+	return PrefixedKey("limiter:" + key)
+}
+
+func (r *redisLimiterImpl) Allow(ctx context.Context, key string, rate contracts.Rate) (*contracts.RateLimitResult, error) {
+	return r.AllowN(ctx, key, rate, 1)
+}
+
+func (r *redisLimiterImpl) AllowN(ctx context.Context, key string, rate contracts.Rate, n int) (*contracts.RateLimitResult, error) {
+	limit := redis_rate.Limit{
+		Rate:   rate.Limit,
+		Period: rate.Period,
+		Burst:  rate.Limit,
+	}
+
+	res, err := r.limiter.AllowN(ctx, r.prefixedKey(key), limit, n)
+	if err != nil {
+		return nil, err
+	}
+
+	return &contracts.RateLimitResult{
+		Allowed:    res.Allowed > 0,
+		Remaining:  res.Remaining,
+		ResetAfter: res.ResetAfter,
+		RetryAfter: res.RetryAfter,
+	}, nil
+}
+
+func (r *redisLimiterImpl) Reset(ctx context.Context, key string) error {
+	return r.limiter.Reset(ctx, r.prefixedKey(key))
+}

backend/plugins/infra/cache/limiter_test.go

@@ -0,0 +1,84 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package cache_test
+
+import (
+	"Wavelet/core"
+	"Wavelet/core/contracts"
+	"Wavelet/plugins/infra/cache"
+	"context"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedisLimiterService(t *testing.T) {
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	defer mr.Close()
+
+	rdb := redis.NewClient(&redis.Options{
+		Addr: mr.Addr(),
+	})
+	defer func() { _ = rdb.Close() }()
+
+	p := cache.New(
+		cache.WithRedis(rdb),
+		cache.WithKeyPrefix("test:"),
+	)
+	ctx := core.NewContext(context.Background())
+	ctx.Config().SetSource(core.NewMapSource(map[string]any{
+		"redis.enabled": true,
+	}))
+	require.NoError(t, ctx.Config().Resolve())
+	require.NoError(t, p.Apply(ctx))
+
+	limiter, err := core.Inject[contracts.LimiterService](ctx)
+	require.NoError(t, err)
+	require.NotNil(t, limiter)
+
+	testCtx := context.Background()
+	rate := contracts.Rate{
+		Limit:  3,
+		Period: time.Minute,
+	}
+
+	// 1st request
+	res, err := limiter.Allow(testCtx, "user:123", rate)
+	require.NoError(t, err)
+	assert.True(t, res.Allowed)
+	assert.Equal(t, 2, res.Remaining)
+
+	// 2nd request
+	res, err = limiter.Allow(testCtx, "user:123", rate)
+	require.NoError(t, err)
+	assert.True(t, res.Allowed)
+	assert.Equal(t, 1, res.Remaining)
+
+	// 3rd request
+	res, err = limiter.Allow(testCtx, "user:123", rate)
+	require.NoError(t, err)
+	assert.True(t, res.Allowed)
+	assert.Equal(t, 0, res.Remaining)
+
+	// 4th request - blocked
+	res, err = limiter.Allow(testCtx, "user:123", rate)
+	require.NoError(t, err)
+	assert.False(t, res.Allowed)
+	assert.Equal(t, 0, res.Remaining)
+	assert.Greater(t, res.RetryAfter, time.Duration(0))
+
+	// Reset
+	err = limiter.Reset(testCtx, "user:123")
+	require.NoError(t, err)
+
+	// Allowed again after reset
+	res, err = limiter.Allow(testCtx, "user:123", rate)
+	require.NoError(t, err)
+	assert.True(t, res.Allowed)
+}

backend/plugins/infra/cache/plugin.go

@@ -8,6 +8,7 @@ import (
 	"Wavelet/core"
 	"Wavelet/core/contracts"
 	"Wavelet/pkg/cache/ram"
+	"Wavelet/pkg/limiter"
 	"Wavelet/pkg/util"
 	"context"
 	"encoding/json"
@@ -139,6 +140,15 @@ func (p *Plugin) Apply(ctx *core.Context) error {
 	}
 
 	core.Provide[contracts.CacheService](ctx, svc)
+
+	var limiterSvc contracts.LimiterService
+	if redisClient != nil {
+		limiterSvc = newRedisLimiter(redisClient, p.keyPrefix)
+	} else {
+		limiterSvc = limiter.NewMemoryLimiter()
+	}
+	core.Provide[contracts.LimiterService](ctx, limiterSvc)
+
 	return nil
 }